- Docs
- Concepts
How It Fits Together
The five ideas Archigov is built on, and the lifecycle that connects a proposal to a decision that stays true.
#The Lifecycle of a Decision
Archigov's core value is coordinated, systematic architecture decision-making. Everything else exists to make that cycle work:
| Stage | What happens | Where |
|---|---|---|
| Propose | An author drafts a decision, a design, or a catalogue artefact, argues it, and tests the argument. | Decisions, Governance catalogue |
| Link | The proposal cites the standards, principles, patterns, policies and earlier decisions it rests on. | Governance catalogue |
| Decide | A typed review is routed to a board; decision makers record positions on the areas they own; the chair declares. | Boards and reviews, Sessions |
| Enforce | Adopted rules and decision constraints are evaluated continuously against the derived model and imported evidence. | Conformance, Derived model |
| Evolve | Drift becomes a finding; a decision is revisited, superseded with lineage, or an exception is granted with an expiry. | Conformance, Decisions |
Every step is recorded in a hash-chained audit log and can be exported as signed evidence.
#Five Ideas
#The Architecture Model Is Derived, Not Authored
The as-is model comes from sources: Azure Resource Graph, CSV and ArchiMate imports, and the Azure DevOps backlog as a feed of planned change. Humans spend their effort on decisions, standards and reviews, not on drawing boxes. This is why an empty instance is useful within minutes, and why a decision's constraints can be checked at all.
#Governance Artefacts Are Machine-checkable Policy
One catalogue holds four kinds of artefact — standards, principles, patterns and policies. Each is a human statement, control references, and optionally a JSON rule. Every adopted artefact with a rule is evaluated by the same engine, so a finding can cite a pattern or a policy just as it cites a standard.
#Boards Decide; The Workflow Is Explicit
Reviews are typed and routed to boards. A board has seats, routing rules, and an approval policy per review type. Decision makers record their own positions; the chair moderates and declares; the secretary runs the sittings. Nobody acts on anyone else's behalf, and the platform administrator — who runs the instance — has no governance rights at all.
#Evidence, Not Assurance
Archigov never claims you are compliant. It shows evidence and who stands behind it. Resource-level checks are imported from Microsoft Defender for Cloud and Azure Policy rather than rebuilt; a rule that needs a configuration fact asserts on that imported evidence, and missing evidence is a finding, never a pass.
#Verification State Is First-class
Every element, relation, decision, standard and AI output carries an origin — derived, inferred, human, ai or rules — and a verification state with who verified it and when. When the underlying content changes, verification drops back to unverified automatically. AI output is always unverified and never approves anything.
#Who Does What
| Person | Typical seat or role | Their part |
|---|---|---|
| Solution architect, engineer | Author | Proposes decisions, designs and artefacts; provides assessments; owns conditions |
| Domain lead (security, data…) | Decision maker on a board, owning areas | Records positions on the areas they own; may delegate their seat for a session |
| Chief architect, board chair | Chair | Moderates, resolves conditionals, declares outcomes, runs the sitting |
| Governance office | Secretary | Plans sessions, records attendance, keeps the notes, manages members and routing |
| Specialist adviser | Reviewer | Comments and pre-reviews; can send an item back; never approves |
| Risk, audit, regulator | Auditor | Reads everything and exports evidence; changes nothing |
| Platform team | Platform admin | Sources, settings, users, backups — and nothing in a review |
See Roles and capabilities for the exact rights.
#What Archigov Deliberately Does Not Do
- It is not a diagramming or free-form modelling tool. Importers are sources with provenance, not editors, and the generated views cover the physical and technology layer only, because only that layer derives deterministically.
- It is not a work tracker. The backlog is a feed that surfaces decisions that are missing or have been invalidated.
- It does not rebuild cloud security posture checks. It imports them as evidence.
- It does not assert compliance, and AI never decides.
Something unclear or out of date? Write to hello@archigov.com or open an issue on GitHub.